muster release v5.41.0

Fixed

• An identity-provider outage during sign-in validation answers 503, not 401. When Dex’s userinfo or discovery endpoint answered 5xx or 429, timed out or refused the connection while muster validated a bearer, the request was answered 401 invalid_token: the client was told its token was dead, and a client that parsed the body as JSON-RPC saw a tool call with an empty answer. mcp-oauth v1.7.2 answers it 503 temporarily_unavailable with Retry-After, as it does a token-store outage; a userinfo rejection stays a 401. (#1501)